Windmill GitHub Action Vulnerability: Early Warning for Engineers
An early warning has been issued regarding a potential vulnerability in Windmill GitHub Action versions up to 1.714.1, where resource-scoped API tokens can reportedly read script contents outside their allowed path due to insufficient enforcement by the scripts/list_search endpoint.
What happened
An early warning has been issued for a potential vulnerability in the Windmill GitHub Action, specifically affecting versions up to 1.714.1. This vulnerability reportedly allows resource-scoped API tokens to read script contents outside their designated path. The issue appears to stem from the scripts/list_search endpoint not properly enforcing the resource/path segment of a scope. Engineers using this action should assess their exposure by reviewing their current version and usage of the Windmill GitHub Action. It is under investigation whether this vulnerability has been exploited. For the latest information, consult the primary sources.
The vulnerability, tracked under GHSA-2PPX-66JV-WPW5, is currently under investigation. The recommended action for engineers is to upgrade to a version beyond 1.714.1 once a patched version is released. Affected components include the windmill (github-actions) up to and including version 1.714.1. Further details on the severity and exact nature of the compromise should be obtained from the primary sources.
How 0Day mitigates this
windmill is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.